fix(deploy): ./setup mints the CI pre-auth key when it deploys the provisioner role #277

Merged

jfraeys merged 1 commit from jfraeys/fix/setup-mints-ci-authkey into main 2026-10-18 13:17:41 -04:00

Conversation 0 Commits 1 Files changed 6 +108 -21

jfraeys commented 2026-10-18 12:43:06 -04:00

Owner

Copy link

`./infra deploy` (no arguments) runs `./setup --workspace linode --confirm-prod`: Terraform plus the full Ansible. Only `scripts/release/deploy-services.sh` minted `CI_EPHEMERAL_TAILSCALE_AUTHKEY`, so the full path failed at `ci_ephemeral_provisioner` ("One or more CI_EPHEMERAL_/TF_VAR_/S3_* secrets are missing", hidden by `no_log`). Confirmed 2026-10-18: all eleven vault-sourced values the role needs were present; the authkey was the missing one. The earlier roles in that run had already been applied, so production was left partly deployed.

• New `scripts/lib/setup/ci_authkey.sh`: `ci_provisioner_will_run ` and `ensure_ci_ephemeral_authkey` (keeps an exported key, else mints a tag:ci reusable+ephemeral one, exports it and its expiry, and returns 1 with a pointer to `--tags headscale` when the mint fails or comes back empty).
• `deploy-services.sh` uses it (same behaviour as before). `./setup` calls it for the `linode` and `ovh` workspaces only, and only when the provisioner role will run: not with `--skip-tags ...ci_ephemeral_provisioner...` (the OVH rehearsal), not with `--limit web`, never for staging or DR.
• The role gets its own assert for the authkey with a message naming it (the generic one stays for the rest).
• Tests: `scripts/tests/test-ci-authkey.sh` (stubbed `./manage`; wired into lint) cover which runs deploy the role, minting, keeping an exported key, failure and empty-mint, and that the key is never printed.

Not run against production. Related side effect seen in the same deploy: #261 changed how container memory limits are written, so the first full deploy recreated the containers (Postfix restart and a PostfixDown alert); a one-off.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

\`./infra deploy\` (no arguments) runs \`./setup --workspace linode --confirm-prod\`: Terraform plus the full Ansible. Only \`scripts/release/deploy-services.sh\` minted \`CI_EPHEMERAL_TAILSCALE_AUTHKEY\`, so the full path failed at \`ci_ephemeral_provisioner\` ("One or more CI_EPHEMERAL_*/TF_VAR_*/S3_* secrets are missing", hidden by \`no_log\`). Confirmed 2026-10-18: all eleven vault-sourced values the role needs were present; the authkey was the missing one. The earlier roles in that run had already been applied, so production was left partly deployed. - New \`scripts/lib/setup/ci_authkey.sh\`: \`ci_provisioner_will_run <tags> <skip-tags> <limit>\` and \`ensure_ci_ephemeral_authkey\` (keeps an exported key, else mints a tag:ci reusable+ephemeral one, exports it and its expiry, and returns 1 with a pointer to \`--tags headscale\` when the mint fails or comes back empty). - \`deploy-services.sh\` uses it (same behaviour as before). \`./setup\` calls it for the \`linode\` and \`ovh\` workspaces only, and only when the provisioner role will run: not with \`--skip-tags ...ci_ephemeral_provisioner...\` (the OVH rehearsal), not with \`--limit web\`, never for staging or DR. - The role gets its own assert for the authkey with a message naming it (the generic one stays for the rest). - Tests: \`scripts/tests/test-ci-authkey.sh\` (stubbed \`./manage\`; wired into lint) cover which runs deploy the role, minting, keeping an exported key, failure and empty-mint, and that the key is never printed. Not run against production. Related side effect seen in the same deploy: #261 changed how container memory limits are written, so the first full deploy recreated the containers (Postfix restart and a PostfixDown alert); a one-off. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys added 1 commit 2026-10-18 12:43:07 -04:00

fix(deploy): ./setup mints the CI pre-auth key when it deploys the provisioner role ... 50d9f587be

./infra deploy (promotion) runs the full Ansible through ./setup, which never minted
CI_EPHEMERAL_TAILSCALE_AUTHKEY (only deploy-services.sh did), so the provisioner role failed its secrets
assert with a generic message. The minting is now one shared function used by both, skipped when the role
will not run (--skip-tags, --limit web, staging/DR). The role names the missing authkey.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys merged commit 3523625a90 into main 2026-10-18 13:17:41 -04:00

jfraeys referenced this pull request from a commit 2026-10-18 13:17:43 -04:00

Merge pull request 'fix(deploy): ./setup mints the CI pre-auth key when it deploys the provisioner role' (#277) from jfraeys/fix/setup-mints-ci-authkey into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jfraeys/infra!277

No description provided.